What’s the point of 2FA, if there’s a recovery code you can use when you lose ability to use your 2FA device?

Question

In the end, isn’t that recovery code just the same as a password?

In: 174

Answer 1

The recovery code ideally wouldn’t be stored in the same place as the password itself. Common recommendation is to write it down on paper and store it somewhere, and keeping it as a single use option to prevent it from being reused indefinitely.